Microsoft Fancy Dances When Activision Plays a Tune
November 29, 2022
In order to convince the European Commission it should be allowed to acquire Activision Blizzard, Microsoft is sampling some humble pie. Android Authority reports, “Microsoft Admits Xbox vs PlayStation War Is Over and It Lost.” Write Ryan McNeal tells us:
“The EU’s European Commission has announced in a press release that it has opened up an in-depth investigation into Microsoft’s proposed acquisition of Activision Blizzard. This investigation was activated after the proposed deadline EU regulators set back in September when the deal was first being looked into. According to the press release, the new inquiry now has 90 working days — until March 23, 2023 — to make a decision. The Commission claims that it is concerned Microsoft’s acquisition could upset the balance in the market, causing a reduction in competition.”
Specifically, the commission suspects Microsoft might make successful PlayStation games like “Call of Duty” into Xbox-only titles. Heavens no, the company insists, it promises to make games available on both platforms simultaneously. This is all about giving the people greater access to games, a representative asserts. And here we thought it was all about creating a distraction. McNeal continues:
“Since the first time it hit a snag with European regulators, Microsoft has attempted to utilize an underdog strategy to delegitimize Sony’s arguments against the deal. In response to today’s investigation announcement, Microsoft attempted to drive that talking point home by admitting that Sony is the market leader.”
Will this self-effacing logic work? We should find out by the end of March. Nota bene: Our team thinks that the push for Activision was possibly a way to deflect attention from some interesting Microsoft security issues. Games are big money, but the issue of Teams in Microsoft 365 may be an even more sensitive issue.
Cynthia Murrell, November 29, 2022
LinkedIn Helps Users Spot Fake Accounts it Lets Slip Through
November 11, 2022
Fake LinkedIn accounts are a fact of life. One might wonder how it is a professional social media site does not require member verification. It seems like a must have, but then LinkedIn is a Microsoft property after all. Now the site is making at least a show of doing something about the issue. No, not increasing efforts to prevent or remove fake profiles; don’t be silly. This is a case of user beware. According to CNN, “LinkedIn Knows There Are Fake Accounts on Its Site. Now It Wants to Help Users Spot Them.” Reporter Clare Duffy writes:
“LinkedIn is rolling out to some users the opportunity to verify their profile using a work email address or phone number. That verification will be incorporated into a new, ‘About this Profile’ section that will also show when a profile was created and last updated, to give users additional context about an account they may be considering connecting with. If an account was created very recently and has other potential red flags, such as an unusual work history, it could be a sign that users should proceed with caution when interacting with it. The verification option will be available to a limited number of companies at first, but will become more widely available over time, and the ‘About this Profile’ section will roll out globally in the coming weeks, according to the company. The platform will also begin alerting users if a message they have received seems suspicious — such as those that invite the recipient to continue the conversation on another platform including WhatsApp (a common move in crypto currency-related scams) or those that ask for personal information.”
We are told detecting and removing bots or fake accounts is just too tricky and subjective to expect LinkedIn to get it right. It is funny how “empowering users” often translates to “passing the buck.” So for those who must use LinkedIn, just remember it is up to you to verify others are who they say they are.
Cynthia Murrell, November 11, 2022
A Flashing Yellow Light for GitHub: Will Indifferent Drivers Notice?
November 9, 2022
I read “We’ve Filed a Lawsuit Challenging GitHub Copilot, an AI Product That Relies on Unprecedented Open-Source Software Piracy. Because AI Needs to Be Bair & Ethical for Everyone.” The write up reports:
… we’ve filed a class-action lawsuit in US federal court in San Francisco, CA on behalf of a proposed class of possibly millions of GitHub users. We are challenging the legality of GitHub Copilot (and a related product, OpenAI Codex, which powers Copilot). The suit has been filed against a set of defendants that includes GitHub, Microsoft (owner of GitHub), and OpenAI.
My view of GitHub is that it presents a number of challenges. On one hand, Microsoft is a pedal-to-the-metal commercial outfit and GitHub is an outfit with some roots in the open source “community” world. Many intelware solutions depend on open source software. In my experience, it is difficult to determine whether cyber security vendors or intelware vendors offer software free of open source code. I am not sure the top dogs in these firms know. Big commercial companies love open source software because these firms see a way to avoid the handcuffs proprietary code vendors use for lock in and lock down without a permission slip. These permissions can be purchased. This fee irritates many of the largest companies which are avid users of open source software.
A second challenge of GitHub is that it serves bad actors in two interesting ways. Those eager to compromise networks, automate phishing attacks, and probe the soft underbelly of companies “protected” by somewhat Swiss Cheese like digital moats rely on open source tools. Second, the libraries for some code on GitHub is fiddled so that those who use libraries but never check too closely about their plumbing are super duper attack and compromise levering vectors. When I was in Romania, “Hooray for GitHub” was, in my opinion, one of the more popular youth hang out disco hits.
The write up adds a new twist: Allegedly inappropriate use of the intellectual property of open source software on GitHub. The write up states:
As far as we know, this is the first class-action case in the US challenging the training and output of AI systems. It will not be the last. AI systems are not exempt from the law. Those who create and operate these systems must remain accountable. If companies like Microsoft, GitHub, and OpenAI choose to disregard the law, they should not expect that we the public will sit still. AI needs to be fair & ethical for everyone.
This issue is an important one. The friction for this matter is that the US government is dependent on open source to some degree. Microsoft is a major US government contractor. A number of Federal agencies are providing money to companies engaged in strategically significant research and development of artificial intelligence.
The different parties to this issue may exert or apply influence.
Worth watching because Amazon- and Google-type companies want to be the Big Dog in smart software. Once the basic technology has been appropriated, will these types of companies pull the plug on open source support and god cloud commercial? Will attorneys benefit while the open source community suffers? Will this legal matter mark the start of a sharp decline in open source software?
Stephen E Arnold, November 9, 2022
Microsoft and Security: Customers! Do Better
November 7, 2022
I have a hunch that cyber security is like Google in the early 2000s. Magic, distractions, and blather helped disguise the firm’s systems and methods for generating revenue. Now (November 4, 2022) the cyber security sector may be taking a page or two from the early Google game plan. Who can blame the cyber security vendors, all 3000 to 7000 of them in the US alone. The variance is a result of the methodology of the business analysts answering the question, “How many companies are chasing commercial, non profit, and government prospects. Either number makes it clear that cyber security is a very big business.
Now stick with me: What operating system and office software is used by about two thirds of the organizations in the United States. The answer, if I can believe the data from my research team, is close enough for horse shoes. Personally, I would peg the penetration of Microsoft software at closer to 90 percent, but let’s go with the 67 percent, plus or minus five percent. That means that cyber security vendors have to provide security for companies already obtaining allegedly secure software and services from Microsoft.
With cyber crime, breaches, zero days, etc, etc going up with dizzying speed, what’s the message I carry away? The answer is, “Cyber security is not working.”
I read “Microsoft Warns Businesses to Up Their Security Game against These Top Threats.” The article then identifies security as a problem. The solution, if I understand the article, is:
Microsoft suggests throughout the MDDR that organizations implement a number of its products into its tech stack to protect against and deal with threats, such as its Security Service Line for support throughout a ransomware attack, and Microsoft Defender for Endpoint for cloud-based protection.
If you are not familiar with MDDR the acronym stands for the Microsoft Digital Defense Report. Presumably Microsoft’s crack security experts and the best available cyber consultants crafted the methods summarized in the article.
The irony is that Microsoft’s own products and services create a large attack surface. Microsoft’s own security tools seem to have chinks, cracks, and gaps which assorted bad actors can exploit.
Net net: Perhaps Microsoft should do security better. Aren’t customers buying solutions which work and do in a way that protects business information and processes? Perhaps less writing about security and more doing security could be helpful?
Stephen E Arnold, November 7, 2022
Microsoft Downplays Revelation of Massive Data Leak
November 1, 2022
Microsoft customers have reason to be annoyed despite the company’s insistence there is nothing to see here. “Microsoft Under Fire After Leaking 2.4TB of Data from Customers Including Contracts, Emails, and More,” reveals Tech Times. Citing a report by cybersecurity firm SOCRadar, writer Joseph Henry tells us:
“According to SOCRadar post, 2.4TB of confidential data from more than 65,000 entities has been leaked because of the misconfiguration in the data bucket. The cybersecurity firm confirms that the data involved in the leak include State of Work (SoW) documents, PII (Personally Identifiable Information) data, Proof-of-Execution (PoE) data, customer emails, project details, product offers, and more. SOCRadar also notes that the above mentioned data spanned five years, particularly from 2017 to August 2022. It should be noted that Microsoft did not include the number of affected customers in its announcement. Unfortunately, instead of acknowledging SOCRadar’s finding, the Redmond giant downplayed the statement by disapproving of its post. Microsoft added that its investigation showed that no customer accounts were compromised in the process.”
Really? What a stroke of good fortune. Henry goes on to share some customer comments regarding the data leak as collected by Ars Technica. Apparently few are reassured by the company’s insistence SOCRadar is exaggerating. If nothing else, some note, this incident highlights Microsoft’s policy of retaining sensitive information in perpetuity. That is not exactly a security best practice. See the SOCRadar post for its description of the misconfiguration that caused this kerfuffle and its potential ramifications.
Which big tech giant will be the next one to get an F in security? My hunch is that it is Amazon’s turn to lose the game of cyber security musical chairs.
Cynthia Murrell, November 1, 2022
Microsoft Goggle Chunder
October 19, 2022
I can resist. I read “Microsoft’s Army Goggles Left U.S. Soldiers with Nausea, Headaches in Test.” I am not too familiar with the training drills for US military personnel. Some create some discomfort. I can here “no pain, no pain” and other friendly, supportive, positive comments.
The write up explains:
U.S. soldiers using Microsoft’s new goggles in their latest field test suffered “mission-affecting physical impairments” including headaches, eyestrain and nausea, according to a summary of the exercise compiled by the Pentagon’s testing office.
How long did it take to create the interesting side effects? Less than three hours.
The trigger for the chunder is Microsoft’s innovation Integrated Visual Augmentation System. I wonder if the acronym or code for the gizmos will be ZUCK which rhymes with upchuck? Probably not.
One government official who works in procurement allegedly said:
the service “conducted a thorough operational evaluation” and “is fully aware” of the testing office’s concerns. The Army is adjusting the program’s fielding and schedule “to allow time to develop solutions to the issues identified…”
One of the issues may be the illumination of the gizmo itself. If true, is this a device designed by those who love science fiction movies or engineers with expertise in warfighting gear? My hunch is that the video game and motion picture aficionados outnumber the combat seasoned on the headgear team.
Bolting a weapon on a robot dog might be an alternative in my opinion.
Will more information be forthcoming? My hunch is that the next report will contain more positive information. F35 pilots seem to be doing okay with their new immersive helmets. Are pilots different from other military professionals?
What if the F35 helmet approach is better than the Softies who continue to struggle with getting printers to work in a way users expect?
Stephen E Arnold, October 19, 2022
Want a Cyber Security Job But Know Zero? Will a Fake LinkedIn Profile Help You?
October 17, 2022
LinkedIn has unwittingly become a vector for the spread of false information. Krebs on Security reports, “Fake CISO Profiles on LinkedIn Target Fortune 500s.” A slew of fake LinkedIn profiles mysteriously appeared for Chief Information Security Officers purportedly serving at high-profile companies. Some were entirely original fabrications, but at least one lifted a description from the actual CISO’s profile. See the write-up for screenshots of a few offending profiles.
Who is fooled? Organizations looking for cybersecurity professionals. And not just on LinkedIn. Apparently other sources unwittingly perpetuated the lies, sources like Google Search, Apollo.io, Signalhire, Cybersecurity Ventures, and Cybercrime Magazine’s CISO 500 list. Whoever is behind the effort must have been delighted. It was apparently Honeywell’s former CISO Rich Mason who first noticed the trend and sounded the alarm. Krebs notes:
“Again, we don’t know much about who or what is behind these profiles, but in August the security firm Mandiant (recently acquired by Google) told Bloomberg that hackers working for the North Korean government have been copying resumes and profiles from leading job listing platforms LinkedIn and Indeed, as part of an elaborate scheme to land jobs at crypto currency firms. None of the profiles listed here responded to requests for comment (or to become a connection). In a statement provided to KrebsOnSecurity, LinkedIn said its teams were actively working to take these fake accounts down.”
We are sure they are. The article suggests some ways the site could make things easier on themselves in the future. Maybe even catch and remove such fabrications before they make it to other media channels. We are told:
“LinkedIn could take one simple step that would make it far easier for people to make informed decisions about whether to trust a given profile: Add a ‘created on’ date for every profile. Twitter does this, and it’s enormously helpful for filtering out a great deal of noise and unwanted communications. The former CISO Mason said LinkedIn also could experiment with offering something akin to Twitter’s verified mark to users who chose to validate that they can respond to email at the domain associated with their stated current employer. … Mason said LinkedIn also needs a more streamlined process for allowing employers to remove phony employee accounts.”
It is unlikely that we’ve seen the last of this tactic. LinkedIn should bolster its safeguards and streamline its reporting process. Meanwhile, other sources must learn to verify information they find on the site. Safeguarding one’s reputation for accurate data should be worth the effort.
Cynthia Murrell, October 17, 2022
Microsoft Teams and Sensitive Information
October 13, 2022
I read a somewhat unusual analysis of Microsoft Teams security. “Microsoft Teams Users Are Using It for a Really Bad Reason, So Stop Now” presents some data about Teams’ users and their sending information over the system. Now the purpose of Teams and similar conferencing software is to exchange information. Therefore, access to Teams sessions and the data exchanged while using the using may have some value to certain individuals if such access were available.
Okay, now let’s look at some of the numbers in the write up:
- 45 percent of those in the sample (who knows how many were in the sample by the way?) “admit to sending confidential and sensitive information frequently via Microsoft Teams.” Now let’s think about this. Does this mean that 55 percent of those using Teams do not provide “confidential or sensitive information”? Is this a measure of productivity which Teams enhances?
- 51 percent were found to be “sharing business critical information.” I am not sure I understand the distinctioin between “sensitive” and “business critical. The idea that half of those using Teams don’t share important data.
- 56 percent believe training is needed.
Net net: Microsoft may have to do more than silence Teams’ blowhards. See “Microsoft Is Working Hard to Shut Up the Egotistical Blowhard on Your Team.”
Stephen E Arnold, October 15, 2022
Russia: Inconsistent Cyber Attack Capabilities
October 7, 2022
Do you remember that Microsoft’s president Brad Smith opined that the SolarWinds’ misstep required about 1,000 engineers? I do. Let’s assume those engineers then turned their attention to compromising Ukraine as part of a special military operation.
“Failure of Russia’s Cyber Attacks on Ukraine Is Most Important Lesson for NCSC” presents information I found interesting about Mr. Smith’s SolarWinds’ remark. [The NCSC is the United Kingdom’s National Cyber Security Council.’
Here’s the key passage from the write up:
Ukrainian cyber defences, IT security industry support and international collaboration have so far prevented Russian cyber attacks from having their intended destabilising impact during Russia’s invasion of Ukraine.
The write up also points out that a cyber content marketing campaign designed to undermine Ukraine’s leadership was also not effective.
Okay, but, Mr. Smith said that Russia was able to coordinate the efforts of 1,000 individuals to breach SolarWinds’ security and create considerable distress among some in commercial enterprises and other organizations.
How could Ukraine resist this type of capable force? I have no idea. I prefer to flip the information around and ask, “Why did SolarWinds’ security yield so easily?” Did Russia put more effort into breaching SolarWinds than fighting a kinetic war? Yeah, sure it did.
Maybe the 1,000 programmer idea was hand waving and blame shifting? Microsoft cannot make printers work. Why would Microsoft security be much better?
Stephen E Arnold, September 2022
Microsoft Teams: Ho Ho Ho
September 30, 2022
That Microsoft Teams is something. I refuse to use it. Others have to use it. I am happy with Zoom. I am fortunate. I can dictate what video tool I use. You? No. Too bad. I try not to think about Teams. I admit to sending my son notices of new Teams’ features, and he has a great sense of humor and sends me smiley faces as a reply. I am not sure he is smiling inside, however.
I noted that Teams popped up in a link to a YCombinator discussion “Why Is Microsoft Teams Still So Bad?.” The comments are informative and interesting; for example:
- Roydivision says: Random crashing.
- Classified says: Once the bean counters discover that you can make money with a piece of software, the game is over.
- M4lvin says: In Germany (or maybe whenever the system language is German) Microsoft decided that everyone should have a Ferris wheel and a bezel in their task bar because now it is Oktoberfest in Munich. Seriously? I think we have reached spam-as-an-operating-system.
- Yawnxyz says: Microsoft product suites are like the Olive Garden of the product world.
- Cyberge99 says: I think Teams also offers more capabilities to Enterprise users. I’ve been on a few teams calls with people on the call that are not visible in the attendee list.
What’s interesting is that:
- People complain but organizations use Microsoft products due to pricing, compliance, institutional momentum, security assertions, familiarity, etc. (Does this mean “monopoly”?)
- Microsoft seems to be assembling a communications equivalent to Word; that is, many features, some of which do not work or cannot be located by a user not intimately familiar with the application. (Is this terminal featuritis?)
- Microsoft’s assertions to the media are not fact checked; otherwise, the comments in the cited thread might be less creditable. (Does science fiction count as a technology deliverable?)
I found the question interesting, but the comments speak more effectively than an equivalent number of TikToks. Viva Teams!
Stephen E Arnold, September 30, 2022
-
- Subscribe to Beyond Search
Feature archive
News archive
-
